CVE-2025-68460: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68460 is an information disclosure vulnerability in the HTML style sanitizer of Roundcube Webmail. It affects versions before 1.5.12 and 1.6.x before 1.6.12, allowing network-based attackers to bypass output encoding without requiring privileges or user interaction. The vulnerability was disclosed on December 18, 2025, with patches released on December 13, 2025. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, or 7.2 (Medium) per ENISA (Red Hat Advisory, Roundcube Advisory).

The root cause is improper encoding or escaping of output (CWE-116) within the sanitize_css_block() function in program/lib/Roundcube/rcube_utils.php. Specifically, the sanitizer failed to detect and reject CSS property values containing semicolons followed by additional content (e.g., value; /style><img src onerror="alert('hello');">), allowing malicious content embedded in CSS string values to escape the style block context. The fix adds a regex check (/;.*/) to detect and discard such invalid or malicious CSS token values before they are passed through. The vulnerability was reported by researcher somerandomdev1 (GitHub Commit, Red Hat Bugzilla).

Successful exploitation allows a remote, unauthenticated attacker to bypass the HTML style sanitizer and potentially exfiltrate sensitive data from email communications or inject malicious content into trusted email messages. The primary impact is on confidentiality (High), with no direct availability impact. In a webmail context, this could expose email content, session-related data, or enable further attacks against users viewing crafted emails (Red Hat Advisory, Roundcube Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.028%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

1. Craft a malicious email: Compose an HTML email containing a <style> block with a CSS property value that embeds a semicolon followed by malicious content, such as body { content: '< page: ;/style><img src onerror="alert(1);">'; color: red; }.
2. Send to target: Deliver the crafted email to a victim using a vulnerable Roundcube Webmail instance (versions before 1.5.12 or 1.6.x before 1.6.12).
3. Trigger sanitizer bypass: When the victim opens the email in Roundcube, the HTML style sanitizer processes the CSS block but fails to detect the embedded semicolon-delimited malicious payload, allowing it to pass through into the rendered output.
4. Achieve information disclosure or content injection: The unsanitized content is rendered in the victim's browser, potentially leaking email content via out-of-band requests (e.g., via CSS url() or injected HTML tags) or injecting attacker-controlled HTML/script into the webmail interface (GitHub Commit).

• Network: Outbound HTTP requests from the Roundcube server or user browsers to unexpected external hosts, potentially triggered by CSS url() references embedded in malicious emails.
• Logs: Roundcube access logs showing emails with unusual <style> blocks containing semicolons within CSS string values; error logs related to CSS parsing anomalies.
• File System: No specific file artifacts expected, as exploitation is transient and occurs during email rendering.
• Process/Application: Unexpected JavaScript execution or DOM manipulation observed in browser developer tools when viewing specific emails in Roundcube.

Roundcube has released patched versions 1.5.12 and 1.6.12, which include a fix that detects and discards CSS token values containing semicolons (invalid or malicious content) in the HTML style sanitizer. Organizations should upgrade to version 1.5.12 (for the 1.5.x branch) or 1.6.12 (for the 1.6.x branch) immediately. No configuration-based workaround is available; upgrading is the only remediation. Debian, Fedora, Mageia, and openSUSE have all issued updated packages (Roundcube Advisory, GitHub Commit, Red Hat Bugzilla).

Security Online Info covered the vulnerability alongside a related SVG XSS flaw (CVE-2025-68461), describing both as high-severity threats to webmail privacy. Debian issued a Long Term Support (LTS) advisory (DLA-4415-1) and a standard security advisory (DSA-6087-1), and Mageia and openSUSE also published security updates. The vulnerability received routine coverage in Linux security news aggregators and community blogs, with no notable controversy or significant researcher commentary beyond the initial disclosure (Security Online, Debian LTS).